Stitching EVPN-VXLAN and L3VPN SR-MPLS for Seamless L3 Connectivity

In modern network architectures, the data center and the service provider core are built on different technologies. Data centers commonly use EVPN-VXLAN to support scalable Spine-Leaf fabrics and workload mobility, while service provider cores use L3VPN over SR-MPLS to deliver multi-tenant IP services.

When services span both domains, connectivity between them must be handled in a controlled and scalable way. Workloads in the data center need Layer 3 reachability to endpoints in the SR-MPLS network, and vice versa. This requires a clear interworking model between EVPN and L3VPN without disrupting either domain.

This blog explains how DriveNets Network Operating System (DNOS) implements stitching between EVPN-VXLAN and L3VPN over SR-MPLS to provide end to end Layer 3 connectivity while maintaining domain separation.

Layer 3 Route Stitching

EVPN VXLAN and L3VPN Stitching

With the DNOS 19.3 Release, you can deploy end-to-end Layer 3 connectivity by stitching EVPN and L3VPN routes. In this scenario, we have endpoints residing in both the SR-MPLS and VXLAN domains.

Network Topology & Prerequisites

To implement this stitching architecture, the underlying transport must be robust and properly segmented. The topology relies on a multi-level IGP structure and Segment Routing:

· Core Transport: SR-MPLS must be operational on R3 and R4.

· Stitching Point: R6 serves as the BGP Route Reflector (RR) and the primary stitching node.

· EVPN is established between R2 and R3.

· IGP Hierarchy: IS-IS L1 manages the EVPN-VXLAN domain. IS-IS L2 manages the SR-MPLS domain.

Layer 3 End to End connectivity

Control Plane Architecture

Control Plane Architecture

· R6 serves both as the BGP Route Reflector and as the stitching node

· R1 peers using the BGP EVPN AFI/SAFI.

· R7 peers using the BGP L3VPN AFI/SAFI.

· Route exchange is pure IP prefix exchange between EVPN and L3VPN

· All participating routers R1, R6, and R7 use VRF instances

· Within the VXLAN domain, EVPN Route Type 5 is used to advertise IP prefixes. This route type carries Layer 3 reachability information.

· VXLAN serves as the EVPN underlay; however, this must be explicitly configured within the instance, as the default encapsulation is MPLS

Route Target Handling:

R1:

·Requires L2VPN/EVPN route targets.

·An export policy must be configured to generate EVPN Route Type 5 prefixes.

R6:

·Must be configured with both EVPN and L3VPN VRF route targets.

·Imports L3VPN routes and re-advertises them as EVPN Route Type 5 routes.

·Adjusts route targets according to policy.

R7:

·Uses standard L3VPN VRF configuration.

Let’s understand first the route flow R7 to R1:

1. R7 advertises standard L3VPN routes to R6 over the SR-MPLS domain.

2. R6 imports these routes based on matching VRF route targets.

3. R6 re-advertises the routes toward the EVPN domain as EVPN Route Type 5 and change the VRF target as per configuration.

4. R1 imports these EVPN Type 5 prefixes into its local VRF.

The same process applies in the reverse direction from R1 toward R7.

Data Plane Behavior

Once the control plane is established and:

· L3VPN routes from R7 appear on R1 as EVPN Route Type 5

· EVPN Route Type 5 routes from R1 appear on R7 as L3VPN routes the network is ready for data forwarding.

In the VXLAN domain, packets are encapsulated with an outer VXLAN header that carries the original Ethernet and IP payload.

At the stitching node R6:

1. For traffic from VXLAN to MPLS:

· The VXLAN header is removed.

· MPLS transport and VPN labels are imposed.

· The packet is forwarded into the SR-MPLS domain.

2. For traffic from MPLS to VXLAN:

· MPLS and VPN labels are removed.

· A VXLAN header is added.

· The packet is forwarded into the VXLAN domain.

This ensures transparent Layer 3 forwarding between domains while preserving VRF isolation.

Packet Flow

Configuration walkover

The following sections cover the unique configuration for the stitching solution, building upon standard IS-IS (L1/L2), BGP RR, and SR-MPLS foundations.

R1 EVPN VXLAN Config:-

R1# show config network-services

network-services
  vrf
    instance evpn-vrf
      interface bundle-111
      interface lo11
      protocols
        bgp 65100
          route-distinguisher 11.11.11.11:101
          address-family ipv4-unicast
            redistribute connected
          !
        !
        evpn
          transport-protocol
            vxlan                       >> Underlay transport need to be used as VXLAN otherwise  default is MPLS
              vni 1001
              vtep-source-if lo0
            !
          !
          export-l2vpn-evpn policy allow-all    >>> Required to move the EVPN route 
          export-l2vpn-evpn route-target 200:200
          import-l2vpn-evpn route-target 200:200

BGP Config:-

R1# show config protocols bgp 65100

protocols
  bgp 65100
    neighbor 6.6.6.6
      remote-as 65100
      update-source lo0
      address-family l2vpn-evpn   >> Enable L2VPN EVPN AFI/SAFI
        send-community community-type both
        soft-reconfiguration inbound
      !
    !
  !

R1 # show config protocols isis | flatten
protocols isis instance isis iso-network 49.0001.0001.0001.0011.0011.00
protocols isis instance isis level level-1
protocols isis instance isis interface lo0 address-family ipv4-unicast 
protocols isis instance isis interface ge100-2/0/6 address-family ipv4-unicast

R6 Configuration:- 

R6 act as L1/L2 for ISIS and enable SR-MPLS.
R6(cfg)# show config protocols isis | flatten
protocols isis instance isis iso-network 49.0001.0001.0001.0006.0006.00
protocols isis instance isis level level-1-2 
protocols isis instance isis address-family ipv4-unicast segment-routing admin-state enabled  >> Enable Segment Routing
protocols isis instance isis interface lo0 address-family ipv4-unicast prefix-sid index 6
protocols isis instance isis interface ge100-0/0/6 address-family ipv4-unicast 
protocols isis instance isis interface ge100-0/0/26 address-family ipv4-unicast 

R6 is the BGP Route Reflector:
R6(cfg)# show config protocols bgp 65100 | flatten
protocols bgp 65100 neighbor 7.7.7.7 remote-as 65100
protocols bgp 65100 neighbor 7.7.7.7 update-source lo0
protocols bgp 65100 neighbor 7.7.7.7 address-family ipv4-vpn route-reflector-client.     >> Enable ipv4-vpn toward R7 L3VPN
protocols bgp 65100 neighbor 7.7.7.7 address-family ipv4-vpn send-community community-type both
protocols bgp 65100 neighbor 7.7.7.7 address-family ipv4-vpn soft-reconfiguration inbound
protocols bgp 65100 neighbor 11.11.11.11 remote-as 65100
protocols bgp 65100 neighbor 11.11.11.11 update-source lo0
protocols bgp 65100 neighbor 11.11.11.11 address-family l2vpn-evpn route-reflector-client >> Enable l2vpn-evpn toward R11 EVPN
protocols bgp 65100 neighbor 11.11.11.11 address-family l2vpn-evpn send-community community-type both
protocols bgp 65100 neighbor 11.11.11.11 address-family l2vpn-evpn soft-reconfiguration inbound

R6(cfg)#  show config network-services | flatten
network-services vrf instance evpn-vrf interface lo6
network-services vrf instance evpn-vrf protocols bgp 65100 route-distinguisher 6.6.6.6:101
network-services vrf instance evpn-vrf protocols bgp 65100 address-family ipv4-unicast export-vpn route-target 200:201
network-services vrf instance evpn-vrf protocols bgp 65100 address-family ipv4-unicast import-vpn route-target 200:201
network-services vrf instance evpn-vrf protocols bgp 65100 address-family ipv4-unicast redistribute connected
network-services vrf instance evpn-vrf protocols evpn transport-protocol vxlan vni 1001
network-services vrf instance evpn-vrf protocols evpn transport-protocol vxlan vtep-source-if lo0
network-services vrf instance evpn-vrf protocols evpn export-l2vpn-evpn policy allow-all
network-services vrf instance evpn-vrf protocols evpn export-l2vpn-evpn route-target 200:200
network-services vrf instance evpn-vrf protocols evpn import-l2vpn-evpn route-target 200:200

R7 ISIS/BGP/SRMPLS/L3VPN VRF ConfigConfiguration: -

R7(cfg)# show config protocols isis | flatten
protocols isis instance isis iso-network 49.0001.0001.0007.0007.0007.00
protocols isis instance isis level level-2
protocols isis instance isis interface lo0 address-family ipv4-unicast prefix-sid index 7
protocols isis instance isis interface ge100-0/0/2.10 address-family ipv4-unicast 

R7(cfg)# show config protocols bgp 65100 | flatten
protocols bgp 65100 neighbor 6.6.6.6 remote-as 65100
protocols bgp 65100 neighbor 6.6.6.6 update-source lo0
protocols bgp 65100 neighbor 6.6.6.6 address-family ipv4-vpn send-community community-type both
protocols bgp 65100 neighbor 6.6.6.6 address-family ipv4-vpn soft-reconfiguration inbound

R7(cfg)# show config network-services | flatten
network-services vrf instance evpn-vrf interface ge100-0/0/39
network-services vrf instance evpn-vrf interface lo7
network-services vrf instance evpn-vrf protocols bgp 65100 route-distinguisher 7.7.7.7:100
network-services vrf instance evpn-vrf protocols bgp 65100 address-family ipv4-unicast export-vpn route-target 200:201
network-services vrf instance evpn-vrf protocols bgp 65100 address-family ipv4-unicast import-vpn route-target 200:201
network-services vrf instance evpn-vrf protocols bgp 65100 address-family ipv4-unicast redistribute connected
network-services vrf instance evpn-vrf protocols bgp 65100 neighbor 172.16.70.1 remote-as 700
network-services vrf instance evpn-vrf protocols bgp 65100 neighbor 172.16.70.1 address-family ipv4-unicast

Verifications

Let’s verify R1 VXLAN/L3 Routes and Forwarding next hop:-

R1(cfg)# show isis neighbors.      >>(ISIS-L1 is Up)
Instance isis:
  System Id                      Interface               Level  State         Last State Change    Holdtime  SNPA
  DN-SA-06                       ge100-2/0/6             L1     Up            1w1d2h49m57s         21        point-to-point

R1(cfg)# show vxlan vtep
| Identifier   | Source      | Destination   | VNI   | Origin type   | Origin instance   |
|--------------+-------------+---------------+-------+---------------+-------------------|
| 300017       | 11.11.11.11 | 6.6.6.6       | 1001  | vrf           | evpn-vrf          |

R1(cfg)# show bgp neighbors 6.6.6.6 advertised-routes.  >> EVPN EVPN Route Type 5 generated toward R6 (BGP-RR)
Route Distinguisher: 11.11.11.11:101

*>  type:=5,eth-tag:=0,ipv4:=172.16.100.0,len:=24 (IP)  11.11.11.11 0 100 32768  ?
*>  type:=5,eth-tag:=0,ipv4:=11.11.11.111,len:=32 (IP)  11.11.11.11 0 100 32768  ?

L3VPN Routes on R1:-
DN-CL-01(cfg 08-Mar-2025-11:16:06)# show bgp instance vrf evpn-vrf route 172.16.70.0  >> L3VPN routes stitched to EVPN 
      6.6.6.6 [vrf default] (metric 10) from 6.6.6.6 (7.7.7.7)
     Stitched from evpn
     Origin incomplete, metric 0, localpref 100, remote-vni 1001, valid, internal, best
     Extended Community: RT:200:200 RT:200:201 ET:VXLAN (0x8) EVPN-Routers-MAC:84:40:76:b5:37:08
     RPKI best-path selection: disabled, allow-invalid: enabled, prefix-validation state: unverified
     Originator: 7.7.7.7, Cluster list: 6.6.6.6
     AddPath ID: RX 0, TX 2
     Last update: 08-Mar-2025 10:58:54 UTC

R1(cfg)# show route vrf evpn-vrf table ipv4-unicast
VRF: evpn-vrf
Codes: K - kernel route, C - connected, S - static, r - RIP,
       O - OSPF, I - IS-IS, B - BGP, P - PIM, A - Babel, D - BFD,
       L - LDP, R - RSVP, M - OAM, I-SR - IS-IS Segment-Routing,
       O-SR - OSPF Segment-Routing, SRTE - Segment-Routing TE,
       EVI - EVI, IKE - IKE, X - Access route,
       > - selected route, * - FIB route, (S) - stale route
       (L) - over limit route, ! - partial MPLS shortcut, m - Multicast
       L1 - IS-IS level-1, L2 - IS-IS level-2, su - summary route
       IA - OSPF inter-area, E1 - OSPF external type 1, E2 - OSPF external type 2
       N1 - OSPF NSSA type 1, N2 - OSPF NSSA type 2, V - VXLAN

BV>           172.16.70.0/31 [200/0] via 6.6.6.6 [vrf default] (recursive) vtep-id 300017, 00:29:07 >> NH pointing to the VTEP
  *                                    via 192.168.116.1, ge100-2/0/6 [vrf default], 00:29:07

Verify on R6 (Stitching node) VXLAN/L3VPN Routes and Forwarding Next hop:

R6(cfg)# show isis neighbors
Instance isis:
  System Id                      Interface               Level  State         Last State Change    Holdtime  SNPA
           R1                           ge100-0/0/6             L1     Up            1w1d3h15m21s         28        point-to-point
            P                             ge100-0/0/26            L2     Up            6d9h28m15s           30        point-to-point
R6(cfg)# show route table mpls-nh
I-SR>*        7.7.7.7/32 [107/20] via 192.168.62.1, ge100-0/0/26 label 16007, 6d09h32m

R6(cfg)# show isis segment-routing label
 Instance isis
  Label   Prefix           Local
-----------------------------------------
  261                      ge100-0/0/26
  263                      ge100-0/0/5
  265                      ge100-0/0/6
  16006   6.6.6.6/32       lo0
  16007   7.7.7.7/32

R6(cfg)# show vxlan vtep
| Identifier   | Source   | Destination   | VNI   | Origin type   | Origin instance   |
|--------------+----------+---------------+-------+---------------+-------------------|
| 300014       | 6.6.6.6  | 11.11.11.11   | 1001  | vrf           | evpn-vrf          |

R6(cfg)# show bgp neighbors 11.11.11.11 advertised-routes.  >> Routes advertised to R1 EVPN Domain
BGP L2vpn EVPN, local router ID is 6.6.6.6
Route Distinguisher: 6.6.6.6:101
*>  type:=5,eth-tag:=0,ipv4:=200.1.0.0,len:=24 (IP)  6.6.6.6  100 0 700 i
*>  type:=5,eth-tag:=0,ipv4:=200.1.1.0,len:=24 (IP)  6.6.6.6  100 0 700 i
*>  type:=5,eth-tag:=0,ipv4:=200.1.2.0,len:=24 (IP)  6.6.6.6  100 0 700 i
*>  type:=5,eth-tag:=0,ipv4:=172.16.70.0,len:=31 (IP)  6.6.6.6 0 100 0  ?
*>  type:=5,eth-tag:=0,ipv4:=1.1.1.6,len:=32 (IP)  6.6.6.6 0 100 32768  ?
*>  type:=5,eth-tag:=0,ipv4:=1.1.1.7,len:=32 (IP)  6.6.6.6 0 100 0  ?

DN-SA-06(cfg)# show bgp neighbors 11.11.11.11 received-routes. >> Routes received from R1 EVPN Domain
BGP L2vpn EVPN, local router ID is 6.6.6.6
Route Distinguisher: 11.11.11.11:101
U*>i type:=5,eth-tag:=0,ipv4:=172.16.100.0,len:=24 (IP)  11.11.11.11 0 100 0  ?
U*>i type:=5,eth-tag:=0,ipv4:=11.11.11.111,len:=32 (IP)  11.11.11.11 0 100 0  ?

R6(cfg)# show bgp neighbors 7.7.7.7 advertised-routes. >> Routes advertised to R7  L3VPN Domain
Route Distinguisher: 6.6.6.6:101
    |       Network      |    Next hop    |Metric|  LocPref | Weight |   Path   |
-----------------------------------------------------------------------------------
*> |1.1.1.6/32          | 6.6.6.6        |     0|       100|   32768|         ?|
*> |11.11.11.111/32     | 6.6.6.6        |     0|       100|       0|         ?|
*> |172.16.100.0/24     | 6.6.6.6        |     0|       100|       0|         ?|

6(cfg)# show bgp neighbors 7.7.7.7 received-routes  >> Routes received fromR7  L3VPN Domain

Route Distinguisher: 7.7.7.7:100
    |       Network      |    Next hop    |Metric|  LocPref | Weight |   Path   |
-----------------------------------------------------------------------------------
U*>i|1.1.1.7/32          | 7.7.7.7        |     0|       100|       0|         ?|
U*>i|172.16.70.0/31      | 7.7.7.7        |     0|       100|       0|         ?|
U*>i|200.1.0.0/24        | 7.7.7.7        |      |       100|       0|     700 i|
U*>i|200.1.1.0/24        | 7.7.7.7        |      |       100|       0|     700 i|
U*>i|200.1.2.0/24        | 7.7.7.7        |      |       100|       0|     700 i|

R6(cfg)# show route vrf evpn-vrf table ipv4-unicast
VRF: evpn-vrf
B>            172.16.70.0/31 [200/0] via 7.7.7.7 [vrf default] (recursive) label 1040387, 00:45:51
  *                                    via 192.168.62.1, ge100-0/0/26 [vrf default] label 16007, 00:45:51 >>Traffic to L3VPN routes forwarded via MPLS 
BV>           172.16.100.0/24 [200/0] via 11.11.11.11 [vrf default] (recursive) vtep-id 300014, 02:01:36
  *                                     via 192.168.116.0, ge100-0/0/6 [vrf default], 02:01:36  >> Traffic to EVPN RT5 will be forwarded for VXLAN

Verify SIS/BGP/SR-MPLS and L3VPN Verification on R7:

R7(cfg)# show isis neighbors
Instance isis:
  System Id                      Interface               Level  State         Last State Change    Holdtime  SNPA
      P                              ge100-0/0/2.10          L2     Up            6d9h51m34s           28        point-to-point

R7(cfg)# show isis segment-routing label
 Instance isis
  Label   Prefix           Local
-------------------------------------------
  298                      ge100-0/0/2.10
  16007   7.7.7.7/32       lo0
  16006   6.6.6.6/32

R7(cfg)# show route table mpls-nh
I-SR>*        6.6.6.6/32 [107/20] via 192.168.72.1, ge100-0/0/2.10 label 16006, 6d09h52m

DN-SA-07(cfg)# show bgp neighbors 6.6.6.6 advertised-routes. >> L3VPN routes advertised to R6 Stitching node
Route Distinguisher: 7.7.7.7:100

    |       Network      |    Next hop    |Metric|  LocPref | Weight |   Path   |
-----------------------------------------------------------------------------------
*> |1.1.1.7/32          | 7.7.7.7        |     0|       100|   32768|         ?|
*> |172.16.70.0/31      | 7.7.7.7        |     0|       100|   32768|         ?|
*> |200.1.0.0/24        | 7.7.7.7        |      |       100|       0|     700 i|
*> |200.1.1.0/24        | 7.7.7.7        |      |       100|       0|     700 i|
*> |200.1.2.0/24        | 7.7.7.7        |      |       100|       0|     700 i|

R7(cfg)# show bgp neighbors 6.6.6.6 received-routes. >> L3VPN routes received from R6 Stitching node
Route Distinguisher: 6.6.6.6:101
    |       Network      |    Next hop    |Metric|  LocPref | Weight |   Path   |
-----------------------------------------------------------------------------------
U*>i|1.1.1.6/32          | 6.6.6.6        |     0|       100|       0|         ?|
U*>i|11.11.11.111/32     | 6.6.6.6        |     0|       100|       0|         ?|
U*>i|172.16.100.0/24     | 6.6.6.6        |     0|       100|       0|         ?|

R7(cfg)# show route vrf evpn-vrf
C>*           172.16.70.0/31 is directly connected, ge100-0/0/39
B>            172.16.100.0/24 [200/0] via 6.6.6.6 [vrf default] (recursive) label 1040385, 00:59:10
  *                                     via 192.168.72.1, ge100-0/0/2.10 [vrf default] label 16006, 00:59:10
B>*           200.1.0.0/24 [20/0] via 172.16.70.1, ge100-0/0/39, 10:46:51
B>*           200.1.1.0/24 [20/0] via 172.16.70.1, ge100-0/0/39, 10:46:51
B>*           200.1.2.0/24 [20/0] via 172.16.70.1, ge100-0/0/39, 10:46:51

Summary

By stitching EVPN-VXLAN and L3VPN over SR-MPLS, DNOS enables seamless Layer 3 connectivity across data center and service provider domains. The architecture maintains domain separation while allowing controlled route exchange and encapsulation translation at a dedicated stitching node.

This approach provides an operationally clean method to unify DC and SP environments without redesigning either domain, preserving existing investments while enabling true end to end IP connectivity.

Disclaimer: Above config/verification are demonstrated with SW version 19.3 release.